Actor(s): APT31
According to PTSecurity, this RAT uses Yandex Disk as a C2.
rule win_yarat_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.yarat." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yarat" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 85ff 0f8486feffff 8bb370040000 8d8594feffff 8b5604 8d4a08 51 } // n = 7, score = 100 // 85ff | test edi, edi // 0f8486feffff | je 0xfffffe8c // 8bb370040000 | mov esi, dword ptr [ebx + 0x470] // 8d8594feffff | lea eax, [ebp - 0x16c] // 8b5604 | mov edx, dword ptr [esi + 4] // 8d4a08 | lea ecx, [edx + 8] // 51 | push ecx $sequence_1 = { c0c06c 661da314 2bc4 89542500 660fbaf013 f8 8b06 } // n = 7, score = 100 // c0c06c | rol al, 0x6c // 661da314 | sbb ax, 0x14a3 // 2bc4 | sub eax, esp // 89542500 | mov dword ptr [ebp], edx // 660fbaf013 | btr ax, 0x13 // f8 | clc // 8b06 | mov eax, dword ptr [esi] $sequence_2 = { ff75e0 8d4de8 e8???????? 8b7dc8 ff75d4 e8???????? 57 } // n = 7, score = 100 // ff75e0 | push dword ptr [ebp - 0x20] // 8d4de8 | lea ecx, [ebp - 0x18] // e8???????? | // 8b7dc8 | mov edi, dword ptr [ebp - 0x38] // ff75d4 | push dword ptr [ebp - 0x2c] // e8???????? | // 57 | push edi $sequence_3 = { d1c8 48 f8 35286e4d10 f5 f6c6d7 33d8 } // n = 7, score = 100 // d1c8 | ror eax, 1 // 48 | dec eax // f8 | clc // 35286e4d10 | xor eax, 0x104d6e28 // f5 | cmc // f6c6d7 | test dh, 0xd7 // 33d8 | xor ebx, eax $sequence_4 = { e8???????? 4a 6685fe f5 0fca f9 85cf } // n = 7, score = 100 // e8???????? | // 4a | dec edx // 6685fe | test si, di // f5 | cmc // 0fca | bswap edx // f9 | stc // 85cf | test edi, ecx $sequence_5 = { e8???????? 56 e8???????? 83c40c 8bd8 5f 5e } // n = 7, score = 100 // e8???????? | // 56 | push esi // e8???????? | // 83c40c | add esp, 0xc // 8bd8 | mov ebx, eax // 5f | pop edi // 5e | pop esi $sequence_6 = { 8bd0 83c418 85d2 756c ff75fc 6a07 ff7510 } // n = 7, score = 100 // 8bd0 | mov edx, eax // 83c418 | add esp, 0x18 // 85d2 | test edx, edx // 756c | jne 0x6e // ff75fc | push dword ptr [ebp - 4] // 6a07 | push 7 // ff7510 | push dword ptr [ebp + 0x10] $sequence_7 = { c68528feffff00 83fa10 722f 8b8d04feffff 42 8bc1 81fa00100000 } // n = 7, score = 100 // c68528feffff00 | mov byte ptr [ebp - 0x1d8], 0 // 83fa10 | cmp edx, 0x10 // 722f | jb 0x31 // 8b8d04feffff | mov ecx, dword ptr [ebp - 0x1fc] // 42 | inc edx // 8bc1 | mov eax, ecx // 81fa00100000 | cmp edx, 0x1000 $sequence_8 = { 895f08 894f04 0fa4f028 8917 80e33b c1f811 5b } // n = 7, score = 100 // 895f08 | mov dword ptr [edi + 8], ebx // 894f04 | mov dword ptr [edi + 4], ecx // 0fa4f028 | shld eax, esi, 0x28 // 8917 | mov dword ptr [edi], edx // 80e33b | and bl, 0x3b // c1f811 | sar eax, 0x11 // 5b | pop ebx $sequence_9 = { 56 57 8b38 8b450c 8b4f0c 8b18 85c9 } // n = 7, score = 100 // 56 | push esi // 57 | push edi // 8b38 | mov edi, dword ptr [eax] // 8b450c | mov eax, dword ptr [ebp + 0xc] // 8b4f0c | mov ecx, dword ptr [edi + 0xc] // 8b18 | mov ebx, dword ptr [eax] // 85c9 | test ecx, ecx condition: 7 of them and filesize < 8692736 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY